Luan Herrera (@lbherrera_) header
Luan Herrera (@lbherrera_) profile picture

Luan Herrera

@lbherrera_
 Brazil
blog.lbherrera.me/posts/
Joined February 2013
  • Tweets631
  • Following448
  • Followers3.3K
21Media
Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)Photo by Luan Herrera (@lbherrera_)
Luan Herrera retweeted
s1r1us (@S1r1u5_) profile picture
s1r1us
@S1r1u5_Oct 29
What if you could backdoor Bash, ls, cp, rm, and other GNU software used by millions of systems? Our research led us to hack GNU Savannah, the infrastructure hosting their source code. The xz backdoor that never happened 🧵
Image from s1r1us (@S1r1u5_)
13
59
6
321
25,798
Luan Herrera retweeted
TRAMOIA (@tramoia_sh) profile picture
TRAMOIA@tramoia_shSep 29
‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰ ‿︵‧˚⊹ CHAMADA DE ARTIGOS ⊹˚‧︵‿ ‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰ ༺༻༺༻ DATA FINAL ༺༻༺༻ ༺༻༺༻ 13/11 ༺༻༺༻ ༺༻༺ [email protected] ༻༺༻ ‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰
8
16
2
40
3,698
Luan Herrera retweeted
s1r1us (@S1r1u5_) profile picture
s1r1us
@S1r1u5_Sep 18
On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
Image from s1r1us (@S1r1u5_)
353
1,382
548
11,803
2,825,283
Luan Herrera retweeted
Tanto Security (@TantoSecurity) profile picture
Tanto Security@TantoSecuritySep 7
🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX tantosec.com/blog/2026/09/te… The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.
From Padding Oracle to Shell: RCE in Telerik UI for ASP.NET AJAX

From Padding Oracle to Shell: RCE in Telerik UI for ASP.NET AJAX

How a sacrificial block turned a decrypt-only padding oracle into a forgery, and the forgery into unauthenticated RCE.

tantosec.com
1
58
5
180
32,134
Watch on YouTube: youtube.com/watch?v=nuJRZZV7…
My Life, AI and the Future of LiveOverflow

My Life, AI and the Future of LiveOverflow

I have been pretty inactive the past 2-3 years and a lot has happen...

youtube.com
2
8
84
13,205
Luan Herrera retweeted
hashkitten (@hash_kitten) profile picture
hashkitten@hash_kittenJul 17
I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances! slcyber.io/research-center/w…

wp2shell: Pre Authentication RCE in WordPress Core

Critical issue discovered in WordPress Core affecting the majority of WordPress-built sites. A pre-authentication Remote Code Execution (RCE) that can be used by attackers to run malicious code to...

slcyber.io
31
228
30
1,032
204,293
Luan Herrera retweeted
caioluders (@caioluders) profile picture
caioluders@caioludersJul 11
lude.rs/hacker-compass/

Hacker Compass — o teste definitivo

Hacker, profissional de sec, noob ou charlatão? Descubra sua coordenada exata na treta.

lude.rs
1
2
14
1,276
[475265304][reward: $3000] NetError's page AutoReloader leads to multi-download blocker bypass crbug.com/475265304
1
4
755
Luan Herrera retweeted
DaviMatsuyama (@davi1337_) profile picture
DaviMatsuyama
@davi1337_May 26
Here we go. my DEF CON CTF writeup, a little different from the others. Also, thanks to Pwn de Queijo for letting me play with you guys. davi1337.gitbook.io/public/d…
DEFCON Quals 26 | Davi1337

DEFCON Quals 26 | Davi1337

challenges.

davi1337.gitbook.io
11
1
93
8,704
Luan Herrera retweeted
Renwa (@RenwaX23) profile picture
Renwa@RenwaX23May 24
"Dad, what was it like playing CTFs before AI?"
26
273
35
1,692
181,760
Luan Herrera retweeted
hashkitten (@hash_kitten) profile picture
hashkitten@hash_kittenMay 19
Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only! xss.hashkitten.io/xss1.html
19
22
9
211
63,885
Luan Herrera retweeted
r3tr074@nso.group (@r3tr074) profile picture
[email protected]@r3tr074May 4
I wrote a blog post about the recent copy(dot)fail bug, trying to explain some general concepts that I think were glossed over in the official article by @theori_io. retr0.zip/blog/cve-2026-3143…
5
95
6
357
67,832
Luan Herrera retweeted
Hacktron AI (@HacktronAI) profile picture
Hacktron AI
@HacktronAIApr 28
Introducing Hacktron Review: an AI security reviewer for your pull requests. It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production. Try for free: app.hacktron.ai
22
42
7
292
77,731
[422531206][reward: $5000] Intersection Observer v2 API fails to correctly determine target's visibility for dynamically changed z-indexes, enabling clickjacking against Google One Tap crbug.com/422531206
1
6
1,103
Luan Herrera retweeted
s1r1us (@S1r1u5_) profile picture
s1r1us
@S1r1u5_Apr 15
I pointed claude opus at chrome and told it to build a full v8 exploit for discord. A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell. hacktron.ai/blog/i-let-claud…
I Let Claude Opus Write a Chrome Exploit: The Next Model (Mythos?) Won't Need My Help?

I Let Claude Opus Write a Chrome Exploit: The Next Model (Mythos?) Won't Need My Help?

I pointed Claude Opus at Discord's bundled Chrome (version 138, nine major versions behind upstream) and asked it to build a full V8 exploit chain. The V8 OOB we used was from Chrome 146, the same...

hacktron.ai
22
171
11
1,053
157,723
Luan Herrera retweeted
caioluders (@caioluders) profile picture
caioluders@caioludersMar 3
new tool PEGA-PEGA Multi-protocol request logger and catcher. Listens on 14 protocols, logs every incoming request, and displays them in a web dashboard and terminal UI. github.com/caioluders/pega-p…
Image from caioluders (@caioluders)
1
3
19
1,113
Luan Herrera retweeted
Rebane (@rebane2001) profile picture
Rebane@rebane2001Feb 24
i built an entire x86 CPU emulator in CSS (no javascript) you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS
317
1,021
264
9,911
1,077,230
Luan Herrera retweeted
Hacktron AI (@HacktronAI) profile picture
Hacktron AI
@HacktronAIFeb 7
🚨 CVE-2026-1731 🚨 Our team discovered a critical pre-auth RCE affecting BeyondTrust Remote Support & Privileged Remote Access. SaaS/Cloud instances have been patched. If you're running self-hosted deployments, apply the patches immediately. More info in the comments.
Image from Hacktron AI (@HacktronAI)
3
63
3
242
36,105
[447172715][reward: $30000] Security: Compromised renderer can control mouse after single tap (UXSS, sandbox escape, and more) crbug.com/447172715
1
21
1
129
12,778
Datr cookie theft and AI leading to Facebook account takeover ($24,000) ysamm.com/uncategorized/2025… Two-click Facebook account takeover via FXAuth ($30,000) ysamm.com/uncategorized/2025… Self-XSS in Facebook payments flow leads to account takeovers ($62,500) ysamm.com/uncategorized/2025…
Image from Youssef Sammouda (sam0) (@samm0uda)
16
138
6
946
96,296
Load more